Skip to content

ROX-14485: update monitoring psp #4655

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Maddosaurus merged 3 commits into from
Feb 2, 2023
Merged

ROX-14485: update monitoring psp #4655

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3afc7c9
Ensure PSPs are not generated by default
Maddosaurus Feb 1, 2023
3385737
linting
Maddosaurus Feb 1, 2023
9a264fe
Update readme
Maddosaurus Feb 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 11 additions & 10 deletions deploy/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,14 @@ $ LOAD_BALANCER=route ./deploy/openshift/deploy.sh

Most environment variables can be found in [common/env.sh](common/env.sh).

| **Name** | **Values** | **Description** |
|--------------------|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `COLLECTION_METHOD` | `ebpf` \| `kernel-module` | Set the collection method for collector. |
| `HOTRELOAD` | `true` \| `false` | `HOTRELOAD` mounts Sensor and Central local binaries into locally running pods. Only works with docker-desktop. Alternatively you can use ./dev-tools/enabled-hotreload.sh. Note however that this will break the linter: https://stack-rox.atlassian.net/browse/ROX-6562 |
| `LOAD_BALANCER` | `route` \| `lb` | Configure how to expose Central, important if deployed on remote clusters. Use `route` for OpenShift, `lb` for Kubernetes. |
| `MAIN_IMAGE_TAG` | `string` | Configure the image tag of the `stackrox/main` image to be deployed. |
| `MONITORING_SUPPORT` | `true` \| `false` | Enable StackRox monitoring. |
| `REGISTRY_USERNAME` | `string` | Set docker registry username to pull the docker.io/stackrox/main image. |
| `REGISTRY_PASSWORD` | `string` | Set docker registry password to pull the docker.io/stackrox/main image. |
| `STORAGE` | `none` \| `pvc` | Defines which storage to use for the Central database, to preserve data between Central restarts it is recommended to use `pvc`. |
| **Name** | **Values** | **Description** |
|-------------------------|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `COLLECTION_METHOD` | `ebpf` \| `kernel-module` | Set the collection method for collector. |
| `HOTRELOAD` | `true` \| `false` | `HOTRELOAD` mounts Sensor and Central local binaries into locally running pods. Only works with docker-desktop. Alternatively you can use ./dev-tools/enabled-hotreload.sh. Note however that this will break the linter: https://stack-rox.atlassian.net/browse/ROX-6562 |
| `LOAD_BALANCER` | `route` \| `lb` | Configure how to expose Central, important if deployed on remote clusters. Use `route` for OpenShift, `lb` for Kubernetes. |
| `MAIN_IMAGE_TAG` | `string` | Configure the image tag of the `stackrox/main` image to be deployed. |
| `MONITORING_SUPPORT` | `true` \| `false` | Enable StackRox monitoring. |
| `MONITORING_ENABLE_PSP` | `true` \| `false` | Generate PodSecurityPolicies for monitoring. Defaults to `false`, as PSPs were deprecated in k8s 1.25. |
| `REGISTRY_USERNAME` | `string` | Set docker registry username to pull the docker.io/stackrox/main image. |
| `REGISTRY_PASSWORD` | `string` | Set docker registry password to pull the docker.io/stackrox/main image. |
| `STORAGE` | `none` \| `pvc` | Defines which storage to use for the Central database, to preserve data between Central restarts it is recommended to use `pvc`. |
10 changes: 7 additions & 3 deletions ...toring/templates/pod-security-policy.yaml → ...toring/templates/pod-security-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: stackrox-monitoring-psp
name: stackrox-monitoring
labels:
app.kubernetes.io/name: stackrox
app: monitoring
rules:
{{- if .Values.enableMonitoringPSPs }}
- apiGroups:
- policy
resources:
Expand All @@ -14,6 +15,7 @@ rules:
- stackrox-monitoring
verbs:
- use
{{- end }}
- apiGroups: [""]
resources:
- endpoints
Expand All @@ -25,20 +27,21 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: stackrox-monitoring-psp
name: stackrox-monitoring
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: stackrox
app: monitoring
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: stackrox-monitoring-psp
name: stackrox-monitoring
subjects:
- kind: ServiceAccount
name: monitoring
namespace: {{ .Release.Namespace }}
---
{{- if .Values.enableMonitoringPSPs }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
Expand Down Expand Up @@ -75,3 +78,4 @@ spec:
ranges:
- min: 4000
max: 4000
{{- end }}
2 changes: 2 additions & 0 deletions deploy/charts/monitoring/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,3 +37,5 @@ alertmanager:
group_by: [alertname]
configmapReload:
enabled: true

enableMonitoringPSPs: ${MONITORING_ENABLE_PSP}
3 changes: 3 additions & 0 deletions deploy/common/env.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,9 @@ echo "ROX_HTPASSWD_AUTH set to $ROX_HTPASSWD_AUTH"

echo "MONITORING_SUPPORT set to ${MONITORING_SUPPORT}"

export MONITORING_ENABLE_PSP=${MONITORING_ENABLE_PSP:-false}
echo "MONITORING_ENABLE_PSP set to ${MONITORING_ENABLE_PSP}"

export CLUSTER=${CLUSTER:-remote}
echo "CLUSTER set to $CLUSTER"

Expand Down